What is the CVSS score of CVE-2024-44097?

CVE-2024-44097 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Nest Doorbell Battery Firmware CVE-2024-44097

CRITICAL

Improper Privilege Management (CWE-269)

2024-10-02 dsap-vuln-management@google.com

Privilege Escalation Nest Doorbell Battery Firmware Nest Cam Outdoor Or Indoor Battery Firmware Nest Cam With Floodlight Firmware Nest Cam Indoor Wired Firmware

9.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (google) · only source for this CVE.

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Oct 02, 2024 - 14:15 cve.org

CRITICAL 9.8

DescriptionCVE.org

According to the researcher: "The TLS connections are encrypted against tampering or eavesdropping. However, the application does not validate the server certificate properly while initializing the TLS connection. This allows for a network attacker to intercept the connection and read the data. The attacker could the either send the client a malicious response, or forward the (possibly modified) data to the real server."

AnalysisAI

According to the researcher: "The TLS connections are encrypted against tampering or eavesdropping. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Privilege Management (CWE-269), which allows attackers to escalate privileges to gain unauthorized elevated access. According to the researcher: "The TLS connections are encrypted against tampering or eavesdropping. However, the application does not validate the server certificate properly while initializing the TLS connection. This allows for a network attacker to intercept the connection and read the data. The attacker could the either send the client a malicious response, or forward the (possibly modified) data to the real server." Affected products include: Google Nest Doorbell \(Battery\) Firmware, Google Nest Cam \(Outdoor Or Indoor\, Battery\) Firmware, Google Nest Cam With Floodlight Firmware, Google Nest Cam \(Indoor\, Wired\) Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply principle of least privilege, validate privilege transitions, implement proper role separation.